Privacy & Disclosure-Risk Analyst

Steampunk; Bloomington (IL); On-site; USD 115,000 - 150,000; Full time

Job summary

Steampunk seeks a Privacy & Disclosure-Risk Analyst to evaluate privacy and data disclosure risks in AI/ML models and federated learning environments. You will perform technical privacy testing and analyze results to guide risk mitigation with cross-functional teams.

The role requires strong understanding of ML privacy, data protection, and risk management, plus clear communication with technical and business stakeholders.

Qualifications

• Bachelor’s degree in CS/Data Science/AI/ML or equivalent.
• 5+ years in cybersecurity, data privacy, or AI/ML security.
• Experience assessing privacy, data exposure, or disclosure risks in technical systems.
• Knowledge of AI/ML privacy attack techniques (model leakage, membership inference, etc.).
• Understanding federated learning concepts and privacy-preserving controls.
• Ability to analyze testing results and communicate risks.

Responsibilities

• Assess privacy and disclosure risks for AI/ML models and federated environments.
• Conduct model leakage and membership-inference testing.
• Evaluate disclosure risks and recommend mitigations.
• Collaborate with ML engineers, data scientists, and security teams.
• Document methodologies, findings, and risk assessments.
• Communicate risks to technical and non-technical stakeholders.

Skills

Analytical thinking

Communication

Collaboration

Problem-solving

Technical testing

Education

Bachelor’s degree in computer science or related field

Tools

Python

Job description

Overview

We are seeking a Privacy & Disclosure-Risk Analyst responsible for evaluating privacy and data disclosure risks associated with AI/ML models and federated learning environments. This role will perform technical privacy testing to identify potential exposure of sensitive or training data through model leakage, membership inference, federated-update reconstruction, and related disclosure-risk techniques.

The Privacy & Disclosure-Risk Analyst will analyze testing results, assess the potential impact of identified privacy vulnerabilities and information exposure, and collaborate with technical teams to identify and validate appropriate risk mitigation measures. This role requires a strong understanding of machine learning concepts, data privacy risks, applicable privacy requirements, and technical approaches for evaluating potential information disclosure from AI/ML systems.

Contributions

• Assess privacy and disclosure risks associated with AI/ML models, training data, and federated learning environments
• Conduct model-leakage testing to identify potential exposure of sensitive, protected, or training data
• Perform membership-inference testing to evaluate whether information about training data can be inferred from model behavior or outputs
• Conduct federated-update reconstruction testing to evaluate potential disclosure of sensitive information from federated learning workflows
• Evaluate AI/ML systems for privacy vulnerabilities, unintended information exposure, and potential disclosure risks
• Develop and execute technical test scenarios and methodologies for evaluating model and data privacy risks
• Analyze testing results to determine the likelihood, severity, and potential impact of identified disclosure risks, including potential impacts to individuals whose information may be exposed
• Evaluate the effectiveness of privacy-preserving controls and recommend appropriate risk mitigation measures
• Collaborate with machine learning engineers, data scientists, cybersecurity teams, and other technical stakeholders to identify and address privacy risks
• Conduct follow-up testing to validate remediation and privacy risk mitigation measures
• Document testing methodologies, technical findings, supporting evidence, risk assessments, and recommended mitigation actions
• Communicate technical privacy and disclosure risks to technical and non-technical stakeholders
• Maintain awareness of emerging AI/ML privacy attacks, disclosure-risk techniques, privacy-preserving machine learning approaches, and evolving AI privacy and risk management guidance

Qualifications

• Ability to obtain and maintain a government security clearance
• Bachelor’s degree in Computer Science, Data Science, Artificial Intelligence, Machine Learning, Cybersecurity, Information Technology, or a related technical discipline, or equivalent relevant experience
• 5+ years of experience in cybersecurity, data privacy, machine learning, AI/ML security, or related technical disciplines
• Experience assessing privacy, data exposure, or disclosure risks within technical systems or data environments
• Strong understanding of machine learning concepts, model training, model outputs, and associated data privacy risks
• Knowledge of AI/ML privacy attack techniques, including model leakage, membership inference, reconstruction, or related disclosure-risk methods
• Experience conducting technical security, privacy, data risk, or adversarial assessments
• Understanding of federated learning or distributed machine learning concepts and associated privacy risks
• Knowledge of privacy-preserving techniques and controls used to reduce unintended information disclosure
• Knowledge of AI risk management principles and frameworks, including the NIST AI Risk Management Framework (AI RMF) or similar guidance
• Ability to analyze technical testing results and assess the potential impact and severity of identified privacy risks
• Experience documenting technical testing methodologies, findings, risks, and recommended mitigation actions
• Strong analytical, problem-solving, communication, and collaboration skills

Preferred

• Hands-on experience conducting model-leakage, membership-inference, model inversion, reconstruction, or similar AI/ML privacy testing
• Hands-on experience assessing privacy and disclosure risks within federated learning environments
• Experience with differential privacy or other privacy-preserving machine learning techniques
• Experience with privacy-enhancing technologies, data minimization, de-identification, anonymization, or related data protection techniques
• Experience using Python or other programming languages for technical privacy, security, or machine learning analysis
• Knowledge of applicable federal privacy laws, regulations, policies, and standards related to sensitive data and information disclosure
• Familiarity with privacy requirements applicable to health, biomedical, research, or other sensitive data
• Experience working with sensitive, health, biomedical, research, or other protected data
• Experience working within federal government or other highly regulated environments
• Relevant privacy, cybersecurity, data science, or AI/ML certification

About steampunk

Steampunk relies on several factors to determine salary, including but not limited to geographic location, contractual requirements, education, knowledge, skills, competencies, and experience. The projected compensation range for this position is $115,000 to $150,000. The estimate displayed represents a typical annual salary range for this position. Annual salary is just one aspect of Steampunk’s total compensation package for employees. Learn more about additional Steampunk benefits here.

Identity Statement

As part of the application process, you are expected to be on camera during interviews and assessments. We reserve the right to take your picture to verify your identity and prevent fraud.

Steampunk is a Change Agent in the Federal contracting industry, bringing new thinking to clients in the Homeland, Federal Civilian, Health and DoD sectors. Through our Human-Centered delivery methodology, we are fundamentally changing the expectations our Federal clients have for true shared accountability in solving their toughest mission challenges.If you want to learn more about our story, visit http://www.steampunk.com.

Equal Opportunity

We are an equal opportunity employer, and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability status, protected veteran status, or any other characteristic protected by law.Steampunk participates in the E-Verify program.